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VISIT PRECIS 


BERNARD BARBIER 
(PHONETIC: bear-NAR bar-BYAY) 
Technical Director 
Directorate for External Security (DGSE), France 


PATRICK PAILLOUX 
(PHONETIC: pah-TREEK pie-YOO) 
Director 
National Information Systems Security (ANSSD, France 


12 April 2013 


Guests Arrive at GH2B: 1030 

Technical Presentation and Discussions: (1045-1215) 
DDIR Hosted Lunch: (1215-1300) 

NSOC Countesy Call: (1300-1330) 

NTOC Courtesy Call: (1330-1430) 

DIRNSA Courtesy Call: (1430-1500) 
Accompanying Senior fill 


(U) BACKGROUND: 


o (TS':SI''NF) Mr. Barbier and Mr. Patrick Pailloux will travel to NSA on 12 April 2013 to 
share information regarding May 2012 cyber attacks on the French Presidential network 
In November 2012, a French magazine revealed information about the attacks and 
accused the U.S. of being responsible. During a January 2013 visit, unbeknownst to FAD 
Desk Officers and SUSLAF, DGSE and ANSSI questioned DIRNSA about the cyber 
attacks and asked about U.S. involvement. DIRNSA denied U.S. involvement and offered 
NSA's assistance to France in attributing the attacks. Two (2) NSA’CSS Threat 
Operations Center (NTOC) Analysts were prepared to travel to Paris in March to provide 
support to the French, DGSE and ANSSI canceled the meeting the day before the team 
was scheduled to depart and instead, requested a visit to NSA on 12 Apnl. For this visit, 
Mr. Barbier and Mr. Pailloux will be accompanied by: 
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(U) PURPOSE OF THE VISIT: 


e (TS"'SL'NF) Mr. Barbier and Mr. Pailloux will present technical details of the cyber 
attacks against the French Presidential network from May 2012. Mr. Barbier and Mr 
Pailloux will meet with senior leaders and analysts from NTOC. SID, IAD, and FAD in 
hopes that NSA can help with attribution 


(U) VISITOR REQUESTED: 


e (S REL TO USA, FRA) DGSE and ANSSI requests help in attributing the cyber attacks 
against the French Presidential network in May 2012. 


(U) CDR DCDR DDIR GUIDANCE: N/A 
(U) PREP SESSION GUIDANCE: 

e (TS.’SL'NF) Prep sessions are scheduled for DIRNSA and D'DIR on 12 Apnl. A 
timeline of events will be prepared that describes the cyber attack, the claims bv French 
media, discussions with DIRNSA, and steps NSA has taken to support the Partner 

(U) NSA/CSS REQUESTED: 


e (S*REL TO USA, FRA) Technical data associated with the cyber attacks against the 
French Presidential network. To date. no advance information has been shared with NSA. 


(C) CYBERCOM REQUESTED: N/A 
(C) COMMON THREADS: 
e (S‘REL TO USA, FRA) Stress the potential value of the NSA-DGSE-ANSSI partnership 


through timely cyber defense exchanges 


(U) KEY TOPIC AREAS: 
e (U.;FOUO) Computer Network Defense (CND) 


(LC) KEY TAKEAWAYS: 


e (S/REL TOUSA, FRA) DIRECTORATE’S ROLE: Recommend DIRNSA 
emphasize the following point: 
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e (S/REL TO USA, FRA) CND Collaboration: Reiterate the need for continued 
close cooperation on CND efforts and emphasize the importance of DGSE and 
ANSSI collaboration to leverage SIGINT to support CND 


(U) VISIT FORMAT: 


e (S* REL USA, FRA) Mr. Barbier and Mr. Pailloux will lead a technical discussion 
relating to the May 2012 cyber attacks against the French Presidential network. D‘DIR 
will host lunch and Courtesy Calls are scheduled with NSOC, NTOC and DIRNSA. 


e SREL TO USA, FRA) NSA participants include: DIRFA, NTOC DIR. IA DIR, SID 
DIR, SUSLAF, FAD Desk Officers, Analysts, and technical Target experts. 


(U) PREVIOUS VISITS AND RESPECTIVE TOPICS: 


e (S” REL USA, FRA) Mr. Barbier last visited NSA in May 2012 for the Strategic 
Planning Conference. Mr. Pailloux last visited NSA in February 2011; this visit focused 
on cyber issues. 


(U) POTENTIAL LANDMINES: 


e (TS.‘SINF) There is a chance that helping attribute the cyber attacks against the French 
Presidential network may reveal a U.S. ally is responsible. 


e (TS"'SI'\NF) The French have not been forthcoming in sharing technical details of the 
cyber attacks. There is suspicion that the information is not being shared prior to the visit 
because the French want to see how NSA responds when they present their findings. 
During the January 2013 DIRNSA visit to Paris, both DGSE and ANSSI asked GEN 
Alexander about the cyber attacks in an attempt to ascertain whether or not the U.S. was 
responsible for the attacks (as reported in French magazines). At no time was FAD made 
aware that DGSE and ANSSI intended to raise the issue with DIRNSA 


(U) OTHER INFORMATION: 


e (TS“'SI:-NF) TAO confirmed that this was not a TAO operation. TAO asked most of 
NSA’s close 1**/2"¢ Party Partners whether thev were involved (CIA, GCHQ. and CSEC 
were the mostly likely suspects); everyone has denied involvement. TAO intentionally 
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did not ask either Mossad or ISNU whether they were involved as France is not an 
approved target for joint discussion. 


e (SNF) After repeated requests for technical information relating to the cyber attacks (in 
advance of the visit), ANSSI and DGSE have not provided any details. 


(UC) RECENT PRESS INDICATIONS: 


e (U) The cyber attacks against the French Presidential network took place in May 2012. 
An initial press report from Paris Atlantico, “French Website Savs Turkish Hackers 
Behind Elvsee Cyber Attacks,” dated 12 July 2012, stated it was believed “the attacks 
originated from France's allies” and speculated Turkish hackers with possible links to 
Turkish “intelligence services or government bodies might be responsible. No follow-on 
press reports have been seen that place blame on Turkey. A press report from Paris 
L'Express, “French Weeklv Reports on Alleged US Cvber Espionage Attack on Elvsee 
Palace,” dated 20 November 2012, shifted blame for the attacks toward the United States. 
On 27 November 2012. @rvret sur images contacted the Paris L'Express author who 
shared there are an “array of assumptions that enable pointing to the United States as the 
origin of this attack. Paris L 'Express contacted ANSSI and the Elvsee. both declined to 
comment 
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